Listing of the Claims; 

Claims 1-9 (Canceled). 

Claim 10 (Currently Amended): A shared secret reconstruction apparatus for 
reconstructing a secret, used for a case where n first shares are generated from original 
secret information, n being an integer equal to or greater than two, by using a first 
threshold secret sharing scheme, in which the original secret information can be 
reconstructed by a collection of at least any k members from a group having n members 
(2 ^ k ^ n), and the n shares are distributed to the n members, t members collected 
fi-om the n members separately possessing the shared secret reconstruction apparatus, t 
being an integer equal to or greater than k, the shared secret reconstruction apparatus thus 
operating together with t - 1 other shared secret reconstruction apparatuses, the shared 
secret reconstruction apparatus comprising: 

a secret sharing operation unit, when t members are collected fi"om the n 
members, generating second shares from a first share held by the shared secret 
reconstruction apparatus by using a (t, t) threshold secret sharing scheme, in which 
original secret information can be reconstructed by a collection of t members from the 
collected t members, and distributing the second shares to the t shared secret 
reconstruction apparatuses of the collected t members including itself; and 

a secret reconstruction operation unit calculating an intermediate result for 
reconstructing the original secret information in a distributed computation by use of the 
output from the secret sharing operation unit and the second shares received from the t - 
1 other shared secret reconstruction apparatuses and transmitting the intermediate result; 
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wherein the secret sharing operation xrnit generates third shares from member ID 
held by the shared secret reconstruction apparatus by using a secret sharing scheme and 
distributes them to the t - 1 other shared secret reconstruction apparatuses, the secret 
reconstruction operation unit thereby calculating an intermediate result for the secret 
reconstruction in the distributed computation by use of the second and third shares output 
from the secret sharing operation unit and receiyed from the t - 1 other shared secret 
reconstruction apparatuses : 

wherein the secret reconstruction operation unit comprises: 

a term calculation unit performing a distributed multiplication on the result of a 
distributed computation performed on a coefficient calculated from the third share to the 
second share and on this second share by use of the second and third shares output from 
the secret sharing operation unit and receiyed from the t - 1 other shared secret 
reconstruction apparatuses; and 

an adder summing all the outputs from the term calculation unit: and 

wherein the term calculation unit comprises: 

a difference operation unit calculating differences between the different third 

shares: 

a first multiple term distributed multiplication unit performing a distributed 
multiplication on the outputs from the difference operation unit: 

a distributed inverse element calculation unit performing a distributed 
computation on the inverse element of the output from the first multiple term distributed 
multiplication unit: 
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a second multiple term distributed multiplication unit performing a distributed 
multiplication on the third shares: and 

a pair of two term distributed multiplication units performing a distributed 
multiplication on the output from the distributed inverse element calculation unit, the 
output from the second multiple term distributed multiplication unit and the 
corresponding second share . 

Claim 1 1 (Canceled). 

Claim 12 (Original): The shared secret reconstruction apparatus of claim 10, further 
comprising a secret reconstruction unit reconstructing the original secret information 
from the output from the secret reconstruction operation unit and the outputs received 
from the t - 1 other shared secret reconstruction apparatuses. 

Claim 13 (Previously Amended): The shared secret reconstruction apparatus of claim 10, 
wherein the second secret sharing scheme generates shares in such a way that the original 
secret information is a sum of all the shares. 

Claim 14 (Original): The shared secret reconstruction apparatus of claim 10, wherein the 
secret reconstruction operation unit comprises an adder summing the output from the 
secret sharing operation unit and the second shares received from the t - 1 other shared 
secret reconstruction apparatuses. 
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Claim 15 (Original): The shared secret reconstruction apparatus of claim 10, wherein the 
secret sharing operation unit uses a threshold secret sharing scheme using member IDs. 

Claim 16 (Previously Amended): The shared secret reconstruction apparatus of claim 10, 
wherein the secret reconstruction operation unit comprises a linear combination operation 
unit performing a linear combination operation on the output from the secret sharing 
operation unit and the second shares received from the t - 1 other shared secret 
reconstruction apparatuses using coefficients calculated from member IDs, the second 
shares being received via secure channels. 

Claim 17 (Original): The shared secret reconstruction apparatus of claim 10, wherein the 
secret sharing operation unit uses a threshold secret sharing scheme using temporary 
member IDs distributed to the shared secret reconstruction apparatus. 

Claims 1 8-20 (Canceled). 

Claim 21 (Currently Amended): The shared secret reconstruction apparatus of claim 3© 
10, wherein each of the first and second multiple term distributed multiplication units 
comprises a number of two term distributed multiplication units each performing a 
distributed multiplication on two values, the number being one less than the number of 
values on which the distributed multiplication is performed. 
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Claim 22 (Original): The shared secret reconstruction apparatus of claim 21, wherein 
each of the two term distributed multiplication units comprises: 
a multiplication imit multiplying two inputs; 

a secret sharing unit generating fourth shares from the output from the 
multiplication unit by using a threshold secret sharing scheme using temporary member 
IDs and distributing them to the t - 1 other shared secret reconstruction apparatuses via 
secure channels; and 

a linear combination operation unit performing a linear combination operation 
on the output from the secret sharing unit and the fourth shares received from the t - 1 
other shared secret reconstruction apparatuses, using coefficients calculated from the 
temporary member IDs via the secure channels. 

Claim 23 (Previously Amended): The shared secret reconstruction apparatus of claim 21, 
wherein each of the two term distributed multiplication units comprises: 

a first multiplication units each multiplying two inputs together and then 
multiplying the product by a coefficient calculated from temporary member IDs; 

first communication operation units each multiplying a first input to itself and a 
second input to a corresponding term distributed multiplication unit in another shared 
secret reconstruction apparatus by performing an oblivious transfer via secure channels; 

second communication operation units each multiplying a second input to itself 
and a first input to a corresponding term distributed multiplication unit in another shared 
secret reconstruction apparatus by performing an oblivious transfer via secure chaimels; 
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first adders each summing the outputs from the first and second conmiunication 
operation units; 

second multiplication units each multiplying the output fi"om one of the first 
adders by a coefficient calculated from temporary member IDs; and 

a second adder summing all the results of the first and second multiplication 

units. 

Claim 24 (Previously Amended): The shared secret reconstruction apparatus of claim 21, 
wherein each of the two term distributed multiplication unit comprises: 

a first multiplication unit multiplying first and second inputs to itself; 

first communication operation units each multiplying the first input to itself and 
a second input to a corresponding term distributed multiplication unit in another shared 
secret reconstruction apparatuses by performing an oblivious transfer via secure channels; 

second communication operation units each multiplying the second input to 
itself and a first input to a corresponding term distributed multiplication unit in another 
shared secret reconstruction apparatus by performing an oblivious transfer via the secure 
channels; 

first adders each summing the outputs fi-om the first and second communication 
operation units; and 

a second adder summing all the resuhs of the first multiplication unit and the 
first adders. 
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Claim 25 (Currently Amended): The shared secret reconstruction apparatus of claim 30 
10 , wherein the distributed inverse element calculation unit comprises: 

a number of distributed multiplication units performing a distributed 
multiplication on two values, the number being calculated from a size of a finite field 
used in the distributed multiplication; and 

a multiple term distributed multiplication unit performing distributed 
multiplication on a number of values calculated from the size of the finite field used in 
the distributed multiplication, the multiple term distributed multiplication unit including a 
number of two term distributed multiplication unit performing a distributed multiplication 
on two values, the number of the two term distributed multiplication unit being one less 
than the number of values on which the distributed multiplication is performed. 

Claim 26 (Currently Amended): The shared secret reconstruction apparatus of claim 30 
10, wherein the distributed inverse element calculation unit comprises: 

a random number generation unit generating a random number; 

a first two term distributed multiplication unit performing a distributed 
multiplication on a first value and the output from the random number generation unit; 

a linear combination operation unit performing a linear combination operation 
on the output from the first two term distributed multiplication unit and output received 
from the corresponding two term distributed multiplication unit in the t - 1 other shared 
secret reconstruction apparatuses, using coefficients calculated from temporary member 
IDs, the output being received via a secure channel; 
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an inverse element operation unit calculating the inverse element of the output 
from the linear combination operation unit in finite field; 

a secret sharing unit generating fifth shares firom the output from the inverse 
element operation unit and distributing them to the t - 1 other shared secret 
reconstruction apparatuses via secure channels; and 

a second two term distributed multiplication unit receiving the fifth share from 
the secret sharing unit and the output from the random number generation unit as inputs 
and having the same structure as the first two term distributed multiplication unit. 

Claim 27 (Currently Amended): The shared secret reconstruction apparatus of claim 30 
10. wherein the distributed inverse element calculation unit comprises: 

a random number generation unit generating a random number; 

a first two term distributed multiplication unit performing a distributed 
multiplication on a first value and the output from the random number generation unit; 

an adder summing the output from the first two term distributed multiplication 
unit and the outputs received from the corresponding first two term distributed 
multiplication unit in the t - 1 other shared secret reconstruction apparatuses, the outputs 
. being received via secure channels; 

an inverse element operation unit calculating the inverse element of the output 
from the adder in finite field; 

a secret sharing unit generating fifth shares from the output from the inverse 
element operation unit and distributing them to the t - 1 other shared secret 
reconstruction apparatuses via secure channels; and 
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a second two term distributed multiplication unit receiving the fifth share from 
the secret sharing unit and the output from the random number generation unit as inputs 
and having the same structure as the first two term distributed multiplication unit. 

Claim 28 (Currently Amended): The shared secret reconstruction apparatus of claim 30 
10 , wherein the distributed inverse element calculation unit comprises: 

a random number generation unit generating a random number; 

a first two term distributed multiplication unit performing a distributed 
multiplication on a first value and the output from the random number generation unit; 

a transmission unit transmitting the result of the first two term distributed 
multiplication unit to a shared secret reconstruction apparatus; 

a receiving unit for receiving the fifth share from the shared secret 
reconstruction apparatus; and 

a second two term distributed multiplication unit performing a distributed 
multiplication on the received fifth share and the output from the random number 
generation unit. 

Claim 29 (Original): A secret reconstruction system for carrying out a secret 
reconstruction method for reconstructing a secret in a secret sharing scheme that 
generates n first shares from the secret information, n being an integer equal to or greater 
than two, the n shares being distributed to a group having n members in such a way that 
the original secret information can be reconstructed by a collection of any t members (2 
^ t ^ n), the secret reconstruction system comprising: 
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a plurality of shared secret reconstruction apparatuses as described in claim 10; 

and 

a secret reconstruction apparatus reconstructing the original secret information 
from the outputs of the plurality of shared secret reconstruction apparatuses. 

Claim 30 (Original): The secret reconstruction system of claim 29, wherein the secret 
reconstruction apparatus is included in one of the plurality of shared secret reconstruction 
apparatuses. 

Claim 3 1 (Original): The secret reconstruction system of claim 29, wherein the secret 
reconstruction apparatus reconstructs the original secret information by siunming the 
outputs of all of the plurality of shared secret reconstruction apparatuses. 

Claim 32 (Original): The secret reconstruction system of claim 29, wherein the secret 
reconstruction apparatus reconstructs the original secret information by using a 
reconstruction method of a threshold secret sharing scheme using temporary member IDs. 

Claim 33 (Original): The secret reconstruction system of claim 29, further comprising a 
temporary member ID generation unit generating mutually distinct temporary member 
IDs to the shared secret reconstruction apparatuses operated by the collected members, 
and distributing and revealing them to the shared secret reconstruction apparatuses. 
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Claim 34 (Original): The secret reconstruction system of claim 33, wherein the first 
shares are generated in such a way that the original secret information is a sum of all the 
first shares. 

Claim 35 (Original): The secret reconstruction system of claim 33, wherein the first 
shares are generated by using a threshold secret sharing scheme using member IDs. 
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